This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP can exploit this flaw to gain unauthorized ability to create, delete, or modify critical data or any data accessible by the product. Additionally, the attacker can cause the application to hang or crash repeatedly, resulting in a complete denial of service. The CVSS vector indicates the attack requires no privileges or user interaction and can be performed remotely with low complexity.

Successful exploitation results in unauthorized modification of critical data or all accessible data within Oracle Hyperion Financial Management, and can cause a complete denial of service by hanging or crashing the application repeatedly. This compromises data integrity and availability but does not impact confidentiality according to the CVSS vector.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to remediate this issue. Oracle recommends staying on actively supported versions and applying security patches without delay. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.